Function withPlatformView

apps/cloud/src/admin/admin-users-api.ts:128–159

(
  headers: AdminUsersHeaders,
  body: (executor: Executor, organizationId: string) => Effect.Effect<A, E>,
)

 * I/O isolation forbids sharing across requests.
 */
const withPlatformView = <A, E extends AdminUsersError | AdminUserNotFound = AdminUsersError>(
  headers: AdminUsersHeaders,
  body: (executor: Executor, organizationId: string) => Effect.Effect<A, E>,
): Effect.Effect<
  A,
  // `AdminUsersError` unconditionally: opening the platform view can fail that
  // way regardless of what `body` itself raises.
  E | AdminUsersError | AdminUsersUnauthorized | AdminUsersForbidden,
  | WorkOSClient
  | ApiKeyService
  | UserStoreService
  | MemberDirectory
  | WorkOsMirror
  | DbProvider
  | PluginsProvider
  | HostConfig
> =>
  Effect.gen(function* () {
    const organizationId = yield* authorizeTenant(
      new Request("https://admin.invalid", { headers }),
    );
    const executor = yield* makePlatformExecutor(organizationId).pipe(
      Effect.mapError(() => new AdminUsersError({ message: "Failed to open the platform view" })),
    );
    // The authorized tenant is handed to the body so the directory reads the
    // SAME org the storage reads are scoped to — never one named by client
    // input.
    return yield* Effect.ensuring(
      body(executor, organizationId),
      executor.close().pipe(Effect.ignore),
    );
  });

/**
 * Cloud's `AdminUsersProvider`, built per request so the platform executor